- How do I install sairahcaz/laravel-xhprof in a Laravel application?
- Install it with Composer using composer require sairahcaz/laravel-xhprof, preferably pinned to a specific version such as v1.3.0. The critical prerequisite is that the XHProf PHP extension is installed and enabled in your runtime, so validate that in your local Docker or dev image first. Then publish and configure the package settings and register the service provider and middleware as described in the README. Because XHProf is a native extension, it also needs to be present in CI and shared staging images, not just on developer machines.
- Does sairahcaz/laravel-xhprof support Laravel 13?
- Yes, v1.3.0 includes a Laravel 13 compatibility update, which is the minimum version to use if you are on or moving to Laravel 13. If you are still on Laravel 10, 11, or 12, check the dependency constraints in composer.json to confirm support rather than assuming it, since the release notes describe the change as additive but do not spell out the full matrix. Pin the version in composer.json and review the changelog and pull requests before upgrading.
- What PHP and XHProf extension versions are required by laravel-xhprof?
- The exact PHP and XHProf constraints should be confirmed from the package's composer.json and README before you commit to it. The main environmental risk with this package is XHProf extension availability and version compatibility in your runtime, not the Laravel code itself. Verify the extension is installed and loads correctly in local development, CI, and shared staging environments. If your base images do not include XHProf, building a dedicated dev or profiling image is usually the simplest path.
- How do I exclude health checks and webhooks from being profiled?
- v1.3.0 adds a URL-skip-by-needle feature that lets you exclude noisy endpoints such as health checks, webhooks, admin routes, and static assets from profiling. Define a standard skip list and keep each needle specific enough that it does not accidentally exclude endpoints you actually want to profile. Check the package documentation to confirm whether matching is substring or regex based and whether it is case sensitive. Overly broad patterns can hide real bottlenecks, while overly narrow ones leave you collecting useless trace data.
- Does laravel-xhprof profile queue jobs and Artisan commands, or only HTTP requests?
- The package is described as capturing request performance data, so its primary focus is HTTP request profiling through middleware. Whether CLI and queue workers are supported should be confirmed in the README and source before relying on it for background job profiling. If you need queue or command profiling, plan on dedicated instrumentation or a broader APM tool. For most teams, the package's value is request-level visibility into slow endpoints.
- Where are the XHProf traces stored, and how do I review the reports?
- Trace storage location and any built-in report viewer depend on the package configuration, so review the published config file to see where reports are written. Because profiling can generate significant trace data, define a retention policy and access controls before enabling it on shared environments. This package is a profiling utility rather than a full APM replacement, so expect to manage storage and cleanup yourself. Documenting storage and retention ownership early avoids surprises as trace volume grows.
- Can I enable profiling only in local or staging environments?
- Yes, and you should. The recommended approach is to gate the middleware so it is active only outside production or for authorized users, combined with skip needles for high-volume routes. This keeps profiling overhead and sensitive request data out of normal user traffic. Treat v1.3.0 as an opt-in developer and staging observability tool rather than a default production dependency. Roll it out to dev and staging first and revisit production only with explicit sampling and guardrails.
- What is the performance overhead of running laravel-xhprof in production?
- XHProf profiling adds measurable overhead per profiled request, and the package can also grow trace storage quickly if enabled broadly. Enabling it for all production traffic without sampling, access control, and retention limits is not recommended. Instead, profile representative endpoints in staging, measure the overhead, and then decide whether limited production use makes sense. The skip-needle feature helps by keeping health checks, webhooks, and other noisy routes out of the capture path.
- Is sairahcaz/laravel-xhprof actively maintained, and what changed in v1.3.0?
- The project is small and community maintained, so pin the version and review it periodically for Laravel compatibility and maintainer continuity. v1.3.0 is a minor, apparently additive release that adds the URL-skip-by-needle filtering feature and Laravel 13 compatibility. The Laravel Shift compatibility contribution is a positive maintenance signal, but the release notes should still be checked for any breaking changes. Overall, the integration surface is low, which keeps the maintenance burden modest.
- What are good alternatives to laravel-xhprof for profiling Laravel applications?
- Common alternatives include Xdebug profiling, Laravel Telescope, Laravel Debugbar, Clockwork, and hosted profilers such as Blackfire. laravel-xhprof is a lightweight option when you already use or are willing to add the XHProf extension and want request-level reports tied to Laravel middleware. Choose a full APM solution if you need always-on production monitoring, sampling, alerting, and long-term trace retention. For targeted bottleneck hunting in development or staging, XHProf-based profiling is usually sufficient.